api-security-best-practices

Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

1.17x

Quality

42%

Does it follow best practices?

Impact

100%

1.17x

Average score across 3 eval scenarios

Securityby

—

The risk profile of this skill

Fix and improve this skill with Tessl

tessl review fix ./skills/api-security-best-practices/SKILL.md

Quality

Content

42%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This skill is highly actionable with excellent, executable code examples covering JWT authentication, input validation, rate limiting, and common security pitfalls. However, it is severely bloated—explaining many concepts Claude already knows, listing obvious best practices, and including the entire OWASP Top 10 inline. The monolithic structure with no progressive disclosure makes it a poor use of context window budget.

Suggestions

Cut the file to ~100 lines: remove 'When to Use', 'Why Rate Limiting?', OWASP Top 10 summaries, do/don't lists, and any explanations of concepts Claude already knows (SQL injection definition, what HTTPS is, etc.)

Move the three large code examples into separate referenced files (e.g., JWT_AUTH.md, INPUT_VALIDATION.md, RATE_LIMITING.md) and keep only a brief summary with links in SKILL.md

Add an explicit security review workflow with validation checkpoints, e.g., '1. Check auth → 2. Verify input validation → 3. Run OWASP scan → 4. If issues found, fix and re-scan → 5. Only deploy when all checks pass'

Remove the 'Additional Resources' external links and 'Pro Tip' footer—these add no actionable value for Claude

Dimension	Reasoning	Score
Conciseness	Extremely verbose at 500+ lines. Explains concepts Claude already knows (what SQL injection is, why rate limiting matters, what HTTPS is). The 'Why Rate Limiting?' bullet list, OWASP Top 10 summaries, and extensive do/don't lists are all knowledge Claude possesses. The 'When to Use This Skill' section with 8 bullets is unnecessary padding.	1 / 3
Actionability	The code examples are fully executable, complete, and copy-paste ready. JWT authentication, input validation with Zod, rate limiting with Redis, and the common pitfalls all include concrete, working JavaScript code with proper error handling and security patterns demonstrated.	3 / 3
Workflow Clarity	Steps 1-5 in 'How It Works' are listed but are abstract descriptions rather than actionable sequences with validation checkpoints. The examples themselves show good patterns but there's no explicit workflow for conducting a security review or audit with validation/verification steps between stages.	2 / 3
Progressive Disclosure	Monolithic wall of text with everything inline. The massive code examples for JWT auth, input validation, and rate limiting should be in separate referenced files. No bundle files exist to offload content, and the skill makes no attempt to split content across files despite being extremely long.	1 / 3
	Total	7 / 12 Passed

Description

42%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description lists concrete security-related API capabilities, which is a strength in specificity. However, it lacks any explicit 'Use when...' trigger guidance, which is a critical omission for skill selection. It could also benefit from more natural user-facing trigger terms and file/technology-specific keywords to reduce overlap with other security-related skills.

Suggestions

Add a 'Use when...' clause such as 'Use when the user asks about API security, securing endpoints, adding authentication/authorization to APIs, or protecting against API attacks.'

Include more natural trigger terms and technology-specific keywords like 'OAuth', 'JWT', 'API keys', 'CORS', 'SQL injection', 'XSS', 'REST security', 'API security best practices'.

Narrow the scope or add distinguishing context to differentiate from general security or web application security skills, e.g., specifying it focuses on REST/GraphQL API design patterns.

Dimension	Reasoning	Score
Specificity	Lists multiple specific concrete actions: authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities. These are distinct, identifiable capabilities.	3 / 3
Completeness	Describes what the skill does but completely lacks a 'Use when...' clause or any explicit trigger guidance for when Claude should select this skill. Per the rubric, a missing 'Use when...' clause caps completeness at 2, and since the 'when' is entirely absent, this scores at 1.	1 / 3
Trigger Term Quality	Includes relevant terms like 'authentication', 'authorization', 'rate limiting', 'input validation', and 'API vulnerabilities' which users might mention, but misses common variations like 'OAuth', 'JWT', 'API keys', 'CORS', 'SQL injection', 'XSS', or 'API security'.	2 / 3
Distinctiveness Conflict Risk	The focus on 'secure API design patterns' is somewhat specific, but terms like 'authentication', 'authorization', and 'input validation' could overlap with general security skills, web application security skills, or broader API design skills.	2 / 3
	Total	8 / 12 Passed

Validation

81%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 9 / 11 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (916 lines); consider splitting into references/ and linking	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	9 / 11 Passed

Repository: popey/claude-code-skills
Path: skills/api-security-best-practices/SKILL.md
Commit: a5a6601

Reviewed: 5 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.